ST-2026-077 · Authentication & identity
Copilot CLI in GitHub Actions replaces stored PAT authentication with GITHUB_TOKEN
Organisation-owned repositories can authenticate Copilot CLI in Actions using the workflow GITHUB_TOKEN and copilot-requests: write.
Previous state
GitHub Actions automations running Copilot CLI required a separately created and stored personal access token.
Current state
Eligible organisation-owned repositories can use the workflow GITHUB_TOKEN after the organisation policy is enabled and copilot-requests: write is granted.
Affected users
Who needs to care
GitHub Actions workflows invoking Copilot CLI in organisation-owned repositories.
Required response
What to do
Update Copilot CLI, enable the organisation policy, grant copilot-requests: write and remove obsolete stored PATs after testing.
Evidence boundary
What the source does not prove
A recent Copilot CLI version and the named policy and workflow permission remain required. AI credits used by the workflow bill directly to the organisation.
Lifecycle history
Dated event sequence
- GITHUB_TOKEN support released
Eligible Actions workflows gained the bounded token path for Copilot CLI.
Evidence ledger
First-party sources
- 01GitHub Changelog — Copilot CLI no longer needs a personal access token in GitHub Actions
Official product changelog · 2026-07-02
Open official source ↗